Tag Info

Hot answers tagged

36

There is no "patch". It's a vulnerability in the protocol, not a bug in the implementation. In Windows Server 2003 to 2012 R2 the SSL / TLS protocols are controlled by flags in the registry set at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols. To disable SSLv3, which the POODLE vulnerability is concerned with, ...


26

A person with administrative (or often even physical) access to a server is going to be able to extract the private key. Whether through exporting, memory sniffing, or other such trickery. Your administrators have access to the private keys of your web servers. Accept this as fact, and work around that. If your sysadmins aren't trustworthy, then you may ...


15

Just for ease of installation I derived this "disable ssl 2 and 3.reg" file from Evan's answer above: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] "Enabled"=dword:00000000 ...


12

The only overhead incurred will be the few bytes taken up in applicationHost.config to define the Application Pools and any non-default settings they may have. If you have a 1000 unused app pools it might improve the time it takes to apply on-the-fly configuration changes to IIS (since there's less XML for the WAS service to parse), but with 5 App Pools I ...


11

When you import the key, you have the option of marking it as non-exportable. This will prevent you from using IIS or the certificate MMC to export it. At least, it makes it a little harder. However, if they have an administrator account on the machine, or have physical access to it - they will still be able to get the key through other means.


11

No. Microsoft offers an FTP over SSL (FTPS) solution but does not currently provide a solution for securing FTP traffic using FTP over SSH (SFTP)


9

Powershell to disable SSL2 and SSL3: 2..3 | %{ New-Item -Path "HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL $_.0\Server" -Name Enabled -Value 0 -Force }


8

The Microsoft IIS server does not support SFTP (or SSH) at all. On any version of Windows. It supports secure FTP (FTPS or FTP over TLS/SSL) though. It's different (incompatible) protocol than SFTP. But most "FTP" clients support both SFTP and FTPS. When setting up FTPS server, make sure you disable plain (unecrypted) FTP! See (my) guide Installing Secure ...


7

To address the most basic part of your question: Yes, you can send commands to a Windows Server from a web interface using the PowerShell Web Access feature in Windows Server 2012 and 2012 R2. For what you want (linking a user control in a web page to the execution of a specific action on the server), you might want to look into executing PowerShell from ...


6

This is a bug in Chrome. You can see in the code that Chrome maintains a list of registry controlled domains and that it needs updated as each gTLD is added. You can see in the effective_tld_names.dat file that the .care domain is not listed, though its listed for other browsers that use a more recent version of the Public Suffix List. This is what causes ...


5

Heartbleed allows memory to be exposed from the server on which [a vulnerable version of] OpenSSL is running, during a TLS connection. So, for heartbleed to be exploitable, a server must both be running a vulnerable version of OpenSSL AND accept TLS connections. Therefore, in Scenario 1, you'd be at risk of having the memory of your load balancer being ...


5

32bit Operating system with 16Gb ram will effectively leave 12Gb's unused. The upgrade to 64bit OS should defenitly be considered. Use of the PAE switch (Physical Adress Extension) could offer a temporary fix. For info with regards to max memory which a OS can use along with the PAE switch info look at: ...


5

Using Server Name Indication requires IIS 8.0. It was not supported in prior versions of IIS. To resolve the problem, do one of the following: Update to IIS 8.0 (and Server 2012). Use a web server other than IIS. Use unique IP addresses for each SSL-enabled web site.


4

In general, it's not a good idea to mix user data with application code. You should maintain these separately, as code lives better in a repo, while data lives in a DB or a "raw" storage system - very different ways of storing information. When you say "a ton" of documents, what does that mean? If you're looking at 100s of GBs in thousands of files, then a ...


4

Open your IIS manager and select the directory you want to protect. Under the "IIS" section select "Authentication". Disable "Anonymous Auth". Enable the desired Auth method (usually "Basic Auth") and it will be valid for this directory only. Add a User account. Give that user Read, Execute, List Permissions on the directory needed, then login via the newly ...


4

IIS provides a certificate chain to the client using the certificates loaded in the server computer's registry. You need to obtain the missing intermediate certificate and install it onto the server so that it can provide a complete certificate chain to clients.


3

The most likely problem is Windows Firewall. Configure it to allow port 8080 traffic. It allows port 80 by default when IIS is installed as a role, but it doesn't automatically configure itself if you change the port.


3

You can use Performance Monitor and Debug Diag to generate dumps on high memory use conditions, including IIS memory usage. Performance Monitor will let you track Asp.NET memory used (there are several counters there), and Debug Diag will let you capture user dumps based on performance counters. After Debug Diag processes a dump, it'll let you know ...


3

The reason for using an App Pool Identity is purely a matter of security. There is another name for this in Windows - they're also called "virtual accounts." The 'network service' and especially 'local machine' accounts have too much privilege by default. Local Machine has unrestricted access to the entire system, and Network Service has the ability to ...


3

You need to know a lot more than you do, to be honest. Even if you had the output from all the tools, and knew where to look for things that can't be automated, what would you do with the information? In your position, I would hire a consultant. Some tools that I use for a generic Windows infrastructure assessment : NMap/ZenMap SpiceWorks (includes ...


3

It's quite common for anti-virus software to scan archives (which includes ZIP files) as they are downloaded. I would check your anti-virus software on both the server and clients for false positives before tearing your hair out over this.


3

No, you cannot set an empty PIN on a Windows 8 Virtual Smart Card. At first I said "having a smart card with no PIN defeats the purpose." But that was too flippant of me. I have Bitlocker enabled on my laptop with a TPM, and I don't need to enter a PIN manually every time I boot up to unlock it. But the fact remains that you can't set an empty PIN on a ...


3

You can use the Registry Editor (regedit.exe) to configure the dumps generated by WER when an application crashes: Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps Create or modify the following Values: DumpCount (DWORD) The DumpCount value is the number of dumps WER will save and keep. Don't set this value too high ...


3

Sorry to say, I think the only appropriate answer is "It depends" - and once you start digging into what "it depends" on, you'll find that you have to benchmark your current site, with good metrics. Then build each scenario you want to test, with a synthetic load that is as close to a busy day on your production site, and monitor the same metrics. Both from ...


3

The Not enough storage available error has nothing to do with disk storage. It is about internal memory. This error is quite easy to reproduce. Simply select a bunch of large files (images or DLL's or whatever), right-click and use the open-with option to open them all with Notepad. This should eat up allot of internal memory. When the swap-file nears it's ...


3

It looks like IIS8 doesn't support frontpage extensions. There's a third party vendor that supplies them; I haven't tried it myself. But apparently, As of December 18, 2010, Microsoft FrontPage Server Extensions (FPSE) 2002 for Windows Vista and Windows Server 2008 RTM is supported by Ready-to-Run Software, Inc. For support and servicing, contact ...


3

TCP connections referencing port 80 at your web servers and a high-numbered port on a public IP address sound like TCP connections from clients to the web servers. How are you establishing that the initiator of these connections is your web servers? Are you seeing TCP SYN's coming from the web servers' port 80? I suspect your firewall device is somehow ...


3

Answer from comments above The best way is trusted connections. As for securing your connection string, a common way of doing it is to put in a config file, set your application pool to run under a specific single-use, strong-password account, and then give only that account access to that file. Seeing as you're not on a domain, to do trusted connections ...


3

Changing the fields to be logged will not cause the AppPool to recycle but it will kill the current AppDomain and start a new one on the next request. So any session state (if in process) is lost. You can easily test this: <%@ Page language="c#" %> <html> <% if (Session["starttime"] == null) { Session.Add("starttime", ...



Only top voted, non community-wiki answers of a minimum length are eligible